Apparmor profile in config.json fails to launch the container

[rajasec]

In my ubuntu system based on 15.04 Kernel : 3.19.0-15. I've enabled the Apparmor compilation so that it is not compiling libcontainer/apparmor/apparmor_disabled.go. After adding the apparmor_profile path in config.json and spec.go. I've tried to start the container, it fails to start the container saying "No such file or directory"
FATA[0000] Container start failed: [8] System error: no such file or directory

ApplyProfile function received the right string ( profile name) from config.json for loading the profile
Upon executing C.aa_change_onexec(cName), it says " No such file or directory". Infact the apparmor profile existed in rootfs under /etc/apparmor.d/

[crosbymichael]

@rajasec did you load the profile with the aa tools and parser?

[rajasec]

@crosbymichael
I have added those inside the container,
but looks like securityfs is not mounted inside the container ( not sure whether it was intentional in design)
I've bypassed using --subdomainfs, still it says
Cache read/write disabled: /sys/kernel/security/apparmor/features interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
Warning from stdin (line 1): apparmor_parser: cannot use or update cache, disable, or force-complain via stdin
AppArmor parser error, in stdin line 2: Could not open 'tunables/global'
Please confirm whether we can add securityfs inside the container during the mounts

[crosbymichael]

@rajasec apparmor is a kernel module so you need to load the profiles on the host machine then consume them via adding the profile name within the config

[rajasec]

@crosbymichael

If the profile is already loaded in host , not sure whether we can load the same profile again in the container.
I've unloaded one of the profile ( /usr/sbin/rsyslogd) in the host, after logging to the container, I could manually load the profile(/usr/sbin/rsyslogd) successfully, But I'm still not able to load via config.json ( it gives the same error) No such file or directory.
May be I'm missing something

[rajasec]

@crosbymichael
Even I tried to do via sample C program. Same error. I dont think it is related to runc. I've filed an separate bug report in Ubuntu Vivid ( 15.04) with the required details.

[crosbymichael]

No it's not a runc issue. Did you use the apparmor_parser to load the profile and is apparmor enabled and the profile active? Are you sure you are using the correct name of the profile? it is not always the name of the file, etc...

[crosbymichael]

Also are you compiling with the apparmor build tag?

[rajasec]

Yes I'm compiling with apparmor build tag for runc (it went for loading the profile and failed to load)
Moreover I'm able to load the profile via apparmor_parser. It is loading successfully inside the container.
I'm using the /etc/apparmor.d/ for loading the profiles.
Thanks for your quick response.

[crosbymichael]

use the parser on your host, not inside the container. The paths will be wrong and it wont beable to find it.

[rajasec]

I tried in the host for the parser. it loaded in the host.
Post that I've started my container with aa_change_onexec "No such file or directory".
As I mentioned earlier, this problem is coming even in the normal C program. I have tried to narrow down using strace for "No such file or directory" . it failed in asprintf call in libapparmor library, where write is happening. If you observe I have given aa_change_profile in my sample C program, it tried to prefix "changeprofile with profile name". if we give aa_change_onexec exec is joined with profile name and it is saying "No such file or directory"

strace output for aa_change_profile
write(3, "changeprofile i_cant_be_trusted_"..., 39) = -1 ENOENT (No such file or directory)

[crosbymichael]

I'm closing this because it sounds to be an issue with host configuration and not with runc as you are experiencing it with other programs.

Apparmor works with standard ubuntu installations so you may want to start from there.